CVE-2024-43887

In the Linux kernel, the following vulnerability has been resolved:

net/tcp: Disable TCP-AO static key after RCU grace period

The lifetime of TCP-AO static_key is the same as the last

tcp_ao_info. On the socket destruction tcp_ao_info ceases to be

with RCU grace period, while tcp-ao static branch is currently deferred

destructed. The static key definition is

DEFINE_STATIC_KEY_DEFERRED_FALSE(tcp_ao_needed, HZ);

which means that if RCU grace period is delayed by more than a second and tcp_ao_needed is in the process of disablement, other CPUs may yet see tcp_ao_info which atent dead, but soon-to-be. And that breaks the assumption of static_key_fast_inc_not_disabled().

See the comment near the definition:

• The caller must make sure that the static key cant get disabled while
• in this function. It doesnt patch jump labels, only adds a user to
• an already enabled static key.

Originally it was introduced in commit eb8c507296f6 (jump_label: Prevent key->enabled int overflow), which is needed for the atomic contexts, one of which would be the creation of a full socket from a request socket. In that atomic context, its known by the presence of the key (md5/ao) that the static branch is already enabled. So, the ref counter for that static branch is just incremented instead of holding the proper mutex. static_key_fast_inc_not_disabled() is just a helper for such usage case. But it must not be used if the static branch could get disabled in parallel as its not protected by jump_label_mutex and as a result, races with jump_label_update() implementation details.

Happened on netdev test-bot1, so not a theoretical issue:

[] jump_label: Fatal kernel bug, unexpected op at tcp_inbound_hash+0x1a7/0x870 [ffffffffa8c4e9b7] (eb 50 0f 1f 44 != 66 90 0f 1f 00)) size:2 type:1 [] ————[ cut here ]———— [] kernel BUG at arch/x86/kernel/jump_label.c:73! [] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI [] CPU: 3 PID: 243 Comm: kworker/3:3 Not tainted 6.10.0-virtme #1 [] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [] Workqueue: events jump_label_update_timeout [] RIP: 0010:__jump_label_patch+0x2f6/0x350 … [] Call Trace: [] [] arch_jump_label_transform_queue+0x6c/0x110 [] __jump_label_update+0xef/0x350 [] __static_key_slow_dec_cpuslocked.part.0+0x3c/0x60 [] jump_label_update_timeout+0x2c/0x40 [] process_one_work+0xe3b/0x1670 [] worker_thread+0x587/0xce0 [] kthread+0x28a/0x350 [] ret_from_fork+0x31/0x70 [] ret_from_fork_asm+0x1a/0x30 [] [] Modules linked in: veth [] —[ end trace 0000000000000000 ]— [] RIP: 0010:__jump_label_patch+0x2f6/0x350

Affected Software

References

• https://git.kernel.org/stable/c/14ab4792ee120c022f276a7e4768f4dcb08f0cdd
• https://git.kernel.org/stable/c/954d55a59b2501f4a9bd693b40ce45a1c46cb2b3